Linux Kernel CVE-2026-72369

Exploitation requires all of the following conditions: (1) the attacker has local system access with the ability to mount filesystems, either via CAP_SYS_ADMIN or via unprivileged user-namespace mount support (kernel.unprivileged_userns_clone=1, common on Ubuntu and Fedora desktop distributions but typically disabled on hardened servers); (2) the minix kernel module is present and loadable (shipped by default in most Linux distributions but blacklistable); (3) the attacker can supply a crafted block device or disk image. Exploitation is strictly local (AV:L) - no network path exists. The primary limiting factors are the local access requirement, the need for mount capability, and the extremely rare legitimate use of the minix filesystem in any production environment. The practical impact is a kernel panic causing a system crash (denial of service), not arbitrary code execution, which further reduces threat severity.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, but the reported C:H/I:H impact metrics are likely inflated for what the description confirms is a kernel panic scenario. A NULL pointer dereference reached via a crafted filesystem mount most commonly yields denial of service rather than arbitrary code execution or data disclosure; the A:H metric is well-supported while C:H and I:H would require additional exploitation primitives not described. EPSS of 0.21% at the 11th percentile signals very low real-world exploitation probability. There is no CISA KEV listing and no public exploit identified at time of analysis. The attack vector is local (AV:L) and requires mount capability (PR:L), which in most hardened Linux deployments means either a privileged account or unprivileged user-namespace mount access (available on many desktop distributions but typically disabled on servers). The minix filesystem is legacy technology from the early Linux era and is essentially unused in production, making the real-world attack surface extremely narrow despite the Linux kernel's ubiquitous deployment. Overall, this is a low-priority issue in practice despite the 7.8 CVSS score: local access is required, the minix module must be present and loadable, and the impact is a system crash rather than code execution.

A local user with CAP_SYS_ADMIN or access to unprivileged user-namespace mounts crafts a Minix v3 disk image with s_ninodes set to 0xFFFFFFFF (UINT_MAX). When the user triggers mount() against this image, minix_blocks_needed() overflows and returns zero, the superblock check passes, and minix_fill_super() dereferences the unallocated s_imap[0] pointer - immediately panicking the kernel and crashing the system. No public exploit code has been identified at time of analysis.